@ikarmic/forge-core 5.1.1 → 5.3.0

package/dist/tools/browser-tools.d.ts

@@ -4,15 +4,15 @@ import type { ToolContext, ToolDefinition } from '../types.js';
 /** Throws unless `rawUrl` is an http(s) URL the browser may visit. */
 export declare function assertBrowsableUrl(rawUrl: string, policy: ToolContext['policy']): Promise<void>;
 declare const observeParams: z.ZodObject<{
-    action: z.ZodEnum<["open", "screenshot", "text", "console", "close"]>;
+    action: z.ZodEnum<{
+        close: "close";
+        text: "text";
+        open: "open";
+        screenshot: "screenshot";
+        console: "console";
+    }>;
     url: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    action: "close" | "text" | "open" | "screenshot" | "console";
-    url?: string | undefined;
-}, {
-    action: "close" | "text" | "open" | "screenshot" | "console";
-    url?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type BrowserResult = {
     action: 'open';
     url: string;
@@ -48,30 +48,14 @@ export declare function createBrowserTools(session: BrowserSession): [
         note?: string;
     }>
 ];
-declare const actParams: z.ZodEffects<z.ZodObject<{
-    action: z.ZodEnum<["click", "type", "evaluate"]>;
+declare const actParams: z.ZodObject<{
+    action: z.ZodEnum<{
+        type: "type";
+        click: "click";
+        evaluate: "evaluate";
+    }>;
     selector: z.ZodOptional<z.ZodString>;
     text: z.ZodOptional<z.ZodString>;
     expression: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    action: "type" | "click" | "evaluate";
-    text?: string | undefined;
-    expression?: string | undefined;
-    selector?: string | undefined;
-}, {
-    action: "type" | "click" | "evaluate";
-    text?: string | undefined;
-    expression?: string | undefined;
-    selector?: string | undefined;
-}>, {
-    action: "type" | "click" | "evaluate";
-    text?: string | undefined;
-    expression?: string | undefined;
-    selector?: string | undefined;
-}, {
-    action: "type" | "click" | "evaluate";
-    text?: string | undefined;
-    expression?: string | undefined;
-    selector?: string | undefined;
-}>;
+}, z.core.$strip>;
 export {};

package/dist/tools/codebase-search.d.ts

@@ -5,13 +5,7 @@ import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     query: z.ZodString;
     limit: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    query: string;
-    limit?: number | undefined;
-}, {
-    query: string;
-    limit?: number | undefined;
-}>;
+}, z.core.$strip>;
 export interface CodebaseSearchResult {
     query: string;
     embedder: string;

package/dist/tools/command-sandbox.d.ts

@@ -0,0 +1,24 @@
+import type { CommandSandbox } from '../types.js';
+export type SandboxedCommand = {
+    kind: 'wrapped';
+    command: string;
+} | {
+    kind: 'unavailable';
+    command: string;
+} | {
+    kind: 'refused';
+    reason: string;
+};
+/** Quote one argument for /bin/sh. */
+export declare function shellQuote(arg: string): string;
+interface Options {
+    cwd: string;
+    sandbox: CommandSandbox;
+    platform: NodeJS.Platform;
+    tmpDir: string;
+    findBinary?: (name: string) => string | undefined;
+    realpath?: (p: string) => string;
+}
+/** The command line that runs `command` inside the sandbox, or why it cannot be sandboxed. */
+export declare function sandboxCommand(command: string, opts: Options): SandboxedCommand;
+export {};

package/dist/tools/command-sandbox.js

@@ -0,0 +1,73 @@
+/**
+ * OS sandbox for run_command (after Kilo's kilo-sandbox): bubblewrap on Linux, sandbox-exec (Seatbelt) on macOS.
+ * Writes are confined to the workspace, the temp folder and any extra folders the user named; the workspace's .git
+ * stays read-only, since a hook written there would later run outside the sandbox; the network is cut unless
+ * allowed. Windows has no comparable tool, so there the command runs as before (approval still applies).
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { resolveOnPath } from '../lsp/client.js';
+/** Quote one argument for /bin/sh. */
+export function shellQuote(arg) {
+    return `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+function defaultFind(name) {
+    for (const dir of ['/usr/bin', '/bin', '/usr/local/bin']) {
+        const full = path.posix.join(dir, name);
+        if (existsSync(full))
+            return full;
+    }
+    return resolveOnPath(name, process.env, process.platform);
+}
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+/** The command line that runs `command` inside the sandbox, or why it cannot be sandboxed. */
+export function sandboxCommand(command, opts) {
+    const find = opts.findBinary ?? defaultFind;
+    const real = opts.realpath ?? safeRealpath;
+    if (opts.platform === 'linux') {
+        const bwrap = find('bwrap');
+        if (!bwrap)
+            return { kind: 'refused', reason: 'The command sandbox is on, but bubblewrap (bwrap) is not installed. Install it (apt install bubblewrap) or turn the sandbox off.' };
+        const writable = [opts.cwd, opts.tmpDir, ...(opts.sandbox.extraWritable ?? [])];
+        const gitDir = path.join(opts.cwd, '.git');
+        const args = [
+            bwrap,
+            '--die-with-parent',
+            '--new-session',
+            '--unshare-pid',
+            ...(opts.sandbox.network ? [] : ['--unshare-net']),
+            '--ro-bind', '/', '/',
+            '--dev', '/dev',
+            '--proc', '/proc',
+            ...writable.flatMap((p) => ['--bind', p, p]),
+            ...(existsSync(gitDir) ? ['--ro-bind', gitDir, gitDir] : []),
+            '--chdir', opts.cwd,
+            '--', '/bin/sh', '-c', command,
+        ];
+        return { kind: 'wrapped', command: args.map(shellQuote).join(' ') };
+    }
+    if (opts.platform === 'darwin') {
+        const exec = find('sandbox-exec');
+        if (!exec)
+            return { kind: 'refused', reason: 'The command sandbox is on, but sandbox-exec was not found. Turn the sandbox off to run commands.' };
+        const quote = (p) => JSON.stringify(real(p));
+        const writable = [opts.cwd, opts.tmpDir, ...(opts.sandbox.extraWritable ?? [])].map((p) => `(subpath ${quote(p)})`);
+        const profile = [
+            '(version 1)',
+            '(allow default)',
+            '(deny file-write*)',
+            `(allow file-write* ${writable.join(' ')} (subpath "/private/var/folders") (literal "/dev/null") (literal "/dev/stdout") (literal "/dev/stderr") (regex #"^/dev/tty"))`,
+            `(deny file-write* (subpath ${quote(path.posix.join(opts.cwd, '.git'))}))`,
+            ...(opts.sandbox.network ? [] : ['(deny network* (remote ip))']),
+        ].join('\n');
+        return { kind: 'wrapped', command: [exec, '-p', profile, '/bin/sh', '-c', command].map(shellQuote).join(' ') };
+    }
+    return { kind: 'unavailable', command };
+}

package/dist/tools/dependency-audit.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../types.js';
+export declare const AUDIT_TIMEOUT_MS = 60000;
+export declare const MAX_AUDIT_CHARS = 60000;
+export interface AuditFinding {
+    package: string;
+    installed?: string;
+    advisory: string;
+    severity: string;
+    fixedIn?: string;
+}
+export interface AuditorPlan {
+    ecosystem: 'npm' | 'pnpm' | 'yarn' | 'python' | 'cargo' | 'go';
+    program: string;
+    args: string[];
+    lockfile: string;
+}
+/** The auditors for the lockfiles at the workspace root, in a fixed order. */
+export declare function pickAuditors(cwd: string): AuditorPlan[];
+/** npm 7+ (`auditReportVersion: 2`): one finding per package with its own advisory; entries that only inherit one are skipped. */
+export declare function parseNpmAudit(text: string): AuditFinding[];
+/** pnpm (npm 6 format): `advisories` keyed by id. */
+export declare function parsePnpmAudit(text: string): AuditFinding[];
+/** pip-audit `-f json`: `{ dependencies: [...] }` (older versions print the list itself). pip-audit reports no severity. */
+export declare function parsePipAudit(text: string): AuditFinding[];
+/** cargo-audit `--json`: `vulnerabilities.list`. */
+export declare function parseCargoAudit(text: string): AuditFinding[];
+declare const params: z.ZodObject<{}, z.core.$strip>;
+export declare const dependencyAuditTool: ToolDefinition<z.infer<typeof params>, string>;
+export {};

package/dist/tools/dependency-audit.js

@@ -0,0 +1,197 @@
+/**
+ * `dependency_audit`: known vulnerabilities in the workspace's dependencies. The auditor is chosen from the
+ * lockfiles at the workspace root and run with fixed arguments; the model chooses nothing. It still asks first
+ * (RB-41): an auditor follows the repository's own settings, so `yarnPath` in .yarnrc.yml runs a script the
+ * repository ships, pip-audit builds sdists, and a cargo alias can replace `cargo audit`. The auditors also
+ * send the dependency list to their registry's advisory service, which the description says.
+ */
+import { execFile } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { resolveOnPath } from '../lsp/client.js';
+import { shellEnv } from './shell-env.js';
+export const AUDIT_TIMEOUT_MS = 60_000;
+export const MAX_AUDIT_CHARS = 60_000;
+const INSTALL_HINT = {
+    npm: 'install Node.js, which ships npm',
+    pnpm: 'npm install -g pnpm',
+    yarn: 'npm install -g yarn',
+    python: 'pip install pip-audit',
+    cargo: 'cargo install cargo-audit',
+    go: 'go install golang.org/x/vuln/cmd/govulncheck@latest',
+};
+/** A requirements file name that is safe to hand to a program a shell may start (npm-style `.cmd` shims on Windows). */
+const REQUIREMENTS = /^requirements[A-Za-z0-9._-]*\.txt$/;
+/** The auditors for the lockfiles at the workspace root, in a fixed order. */
+export function pickAuditors(cwd) {
+    const has = (name) => existsSync(path.join(cwd, name));
+    const plans = [];
+    if (has('package-lock.json'))
+        plans.push({ ecosystem: 'npm', program: 'npm', args: ['audit', '--json'], lockfile: 'package-lock.json' });
+    if (has('pnpm-lock.yaml'))
+        plans.push({ ecosystem: 'pnpm', program: 'pnpm', args: ['audit', '--json'], lockfile: 'pnpm-lock.yaml' });
+    if (has('yarn.lock')) {
+        let berry = false;
+        try {
+            berry = readFileSync(path.join(cwd, 'yarn.lock'), 'utf8').includes('__metadata:');
+        }
+        catch {
+            // Unreadable: treat as classic.
+        }
+        plans.push({ ecosystem: 'yarn', program: 'yarn', args: berry ? ['npm', 'audit', '--json', '--recursive'] : ['audit', '--json'], lockfile: 'yarn.lock' });
+    }
+    let entries = [];
+    try {
+        entries = readdirSync(cwd).sort();
+    }
+    catch {
+        // An unreadable folder has no requirements files.
+    }
+    for (const name of entries.filter((n) => REQUIREMENTS.test(n))) {
+        plans.push({ ecosystem: 'python', program: 'pip-audit', args: ['-f', 'json', '-r', name], lockfile: name });
+    }
+    const pyLock = ['poetry.lock', 'uv.lock'].find(has);
+    if (pyLock)
+        plans.push({ ecosystem: 'python', program: 'pip-audit', args: ['-f', 'json', '.'], lockfile: pyLock });
+    if (has('Cargo.lock'))
+        plans.push({ ecosystem: 'cargo', program: 'cargo', args: ['audit', '--json'], lockfile: 'Cargo.lock' });
+    if (has('go.sum'))
+        plans.push({ ecosystem: 'go', program: 'govulncheck', args: ['-json', './...'], lockfile: 'go.sum' });
+    return plans;
+}
+const rec = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
+const str = (v) => (typeof v === 'string' && v ? v : undefined);
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function finding(f) {
+    return Object.fromEntries(Object.entries(f).filter(([, v]) => v !== undefined));
+}
+/** npm 7+ (`auditReportVersion: 2`): one finding per package with its own advisory; entries that only inherit one are skipped. */
+export function parseNpmAudit(text) {
+    const out = [];
+    for (const [name, raw] of Object.entries(rec(rec(parseJson(text)).vulnerabilities))) {
+        const v = rec(raw);
+        const via = Array.isArray(v.via) ? v.via.map(rec).find((x) => str(x.url) || str(x.title)) : undefined;
+        if (!via)
+            continue;
+        const url = str(via.url) ?? '';
+        const fix = rec(v.fixAvailable);
+        out.push(finding({
+            package: name,
+            advisory: url.match(/GHSA-[a-z0-9-]+/i)?.[0] ?? str(via.title) ?? url,
+            severity: str(v.severity) ?? 'unknown',
+            fixedIn: str(fix.name) === name ? str(fix.version) : undefined,
+        }));
+    }
+    return out;
+}
+/** pnpm (npm 6 format): `advisories` keyed by id. */
+export function parsePnpmAudit(text) {
+    return Object.values(rec(rec(parseJson(text)).advisories)).map((raw) => {
+        const a = rec(raw);
+        const first = Array.isArray(a.findings) ? rec(a.findings[0]) : {};
+        return finding({
+            package: str(a.module_name) ?? 'unknown',
+            installed: str(first.version),
+            advisory: str(a.github_advisory_id) ?? str(a.url) ?? str(a.title) ?? 'unknown',
+            severity: str(a.severity) ?? 'unknown',
+            fixedIn: str(a.patched_versions),
+        });
+    });
+}
+/** pip-audit `-f json`: `{ dependencies: [...] }` (older versions print the list itself). pip-audit reports no severity. */
+export function parsePipAudit(text) {
+    const parsed = parseJson(text);
+    const deps = Array.isArray(parsed) ? parsed : rec(parsed).dependencies;
+    if (!Array.isArray(deps))
+        return [];
+    const out = [];
+    for (const d of deps.map(rec)) {
+        for (const v of Array.isArray(d.vulns) ? d.vulns.map(rec) : []) {
+            const fixes = Array.isArray(v.fix_versions) ? v.fix_versions.filter((x) => typeof x === 'string') : [];
+            out.push(finding({ package: str(d.name) ?? 'unknown', installed: str(d.version), advisory: str(v.id) ?? 'unknown', severity: 'unknown', fixedIn: fixes.join(', ') || undefined }));
+        }
+    }
+    return out;
+}
+/** cargo-audit `--json`: `vulnerabilities.list`. */
+export function parseCargoAudit(text) {
+    const list = rec(rec(parseJson(text)).vulnerabilities).list;
+    if (!Array.isArray(list))
+        return [];
+    return list.map(rec).map((v) => {
+        const adv = rec(v.advisory);
+        const pkg = rec(v.package);
+        const patched = rec(v.versions).patched;
+        return finding({
+            package: str(pkg.name) ?? str(adv.package) ?? 'unknown',
+            installed: str(pkg.version),
+            advisory: str(adv.id) ?? 'unknown',
+            severity: str(adv.severity) ?? 'unknown',
+            fixedIn: Array.isArray(patched) ? patched.filter((x) => typeof x === 'string').join(', ') || undefined : undefined,
+        });
+    });
+}
+const PARSERS = {
+    npm: parseNpmAudit,
+    pnpm: parsePnpmAudit,
+    python: parsePipAudit,
+    cargo: parseCargoAudit,
+};
+function runAuditor(program, args, cwd) {
+    // npm-style `.cmd` shims need a shell on Windows; the arguments are fixed or checked above, never the model's.
+    const shell = process.platform === 'win32' && /\.(cmd|bat)$/i.test(program);
+    return new Promise((resolve) => {
+        execFile(shell ? `"${program}"` : program, args, { cwd, env: shellEnv(process.env), shell, timeout: AUDIT_TIMEOUT_MS, maxBuffer: 64 * 1024 * 1024, windowsHide: true }, (err, stdout, stderr) => {
+            // Auditors exit non-zero when they find something: the JSON on stdout is still the answer.
+            if (err && !String(stdout).trim())
+                resolve({ stdout: '', error: (String(stderr).trim() || err.message).split('\n')[0] });
+            else
+                resolve({ stdout: String(stdout) });
+        });
+    });
+}
+function formatFindings(plan, findings) {
+    const head = `${plan.program} ${plan.args.join(' ')} (${plan.lockfile}): ${findings.length} known vulnerabilit${findings.length === 1 ? 'y' : 'ies'}`;
+    const lines = findings.map((f) => `- ${f.package}${f.installed ? ` ${f.installed}` : ''}: ${f.advisory} (${f.severity})${f.fixedIn ? `, fixed in ${f.fixedIn}` : ''}`);
+    return [head, ...lines].join('\n');
+}
+const params = z.object({});
+export const dependencyAuditTool = {
+    name: 'dependency_audit',
+    description: 'Check the project dependencies for known vulnerabilities with the auditor that fits its lockfile (npm, pnpm, yarn, pip-audit, cargo audit, govulncheck). ' +
+        "It changes no files, but the auditor follows the project's own package-manager settings and can run code the project ships, so it asks first. It contacts the package registry: the dependency list is sent to its advisory service. Takes no arguments.",
+    parameters: params,
+    destructive: true,
+    execute: async (_args, ctx) => {
+        const plans = pickAuditors(ctx.cwd);
+        if (plans.length === 0)
+            return 'Nothing to audit: no lockfile or requirements file at the project root.';
+        const env = shellEnv(process.env);
+        const parts = [];
+        for (const plan of plans) {
+            const program = resolveOnPath(plan.program, env, process.platform);
+            if (!program) {
+                parts.push(`${plan.program} is not installed, so ${plan.lockfile} was not audited. To install it: ${INSTALL_HINT[plan.ecosystem]}.`);
+                continue;
+            }
+            const { stdout, error } = await runAuditor(program, plan.args, ctx.cwd);
+            if (error) {
+                const missing = /no such (sub)?command|unknown command/i.test(error);
+                parts.push(missing ? `${plan.program} ${plan.args[0]} is not installed. To install it: ${INSTALL_HINT[plan.ecosystem]}.` : `${plan.program} failed: ${error}`);
+                continue;
+            }
+            const parse = PARSERS[plan.ecosystem];
+            parts.push(parse ? formatFindings(plan, parse(stdout)) : `${plan.program} output (not parsed):\n${stdout}`);
+        }
+        const text = parts.join('\n\n');
+        return text.length > MAX_AUDIT_CHARS ? `${text.slice(0, MAX_AUDIT_CHARS)}\n[audit output cut: ${text.length - MAX_AUDIT_CHARS} characters left out]` : text;
+    },
+};

package/dist/tools/edit-file.d.ts

@@ -4,26 +4,20 @@ declare const params: z.ZodObject<{
     path: z.ZodString;
     old_text: z.ZodString;
     new_text: z.ZodString;
-    /**
-     * If true (default), require old_text to match exactly once. If false,
-     * replace_all mode is used and every occurrence is replaced.
-     */
     replace_all: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    old_text: string;
-    new_text: string;
-    replace_all?: boolean | undefined;
-}, {
-    path: string;
-    old_text: string;
-    new_text: string;
-    replace_all?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 export interface EditFileResult {
     path: string;
     replacements: number;
     bytes: number;
 }
 export declare const editFileTool: ToolDefinition<z.infer<typeof params>, EditFileResult>;
+/**
+ * What edit_file writes for `original`; throws the message the model sees when old_text cannot be placed.
+ * Shared with the chat's diff preview so the two never disagree.
+ */
+export declare function applyTextEdit(original: string, oldTextIn: string, newTextIn: string, replaceAll: boolean, file: string): {
+    content: string;
+    replacements: number;
+};
 export {};

package/dist/tools/edit-file.js

@@ -24,29 +24,77 @@ export const editFileTool = {
                 throw new Error(`File not found: ${args.path}`);
             throw err;
         });
-        const occurrences = countOccurrences(original, args.old_text);
-        if (occurrences === 0) {
-            throw new Error(`old_text not found in ${args.path}. Re-read the file (it may have changed) and try again.`);
-        }
-        const replaceAll = args.replace_all === true;
-        if (!replaceAll && occurrences > 1) {
-            throw new Error(`old_text matches ${occurrences} times in ${args.path}. Pass more context to make it unique, or set replace_all=true to replace all occurrences.`);
-        }
-        const updated = replaceAll
-            ? original.split(args.old_text).join(args.new_text)
-            // Use a replacer FUNCTION so new_text is inserted literally: a plain
-            // string 2nd arg to String.prototype.replace still honors special
-            // patterns like $&, $1, $$ even though old_text isn't a regex.
-            : original.replace(args.old_text, () => args.new_text);
-        const bytes = encodeText(updated, encoding);
+        const { content, replacements } = applyTextEdit(original, args.old_text, args.new_text, args.replace_all === true, args.path);
+        const bytes = encodeText(content, encoding);
         await writeFile(resolved, bytes);
         return {
             path: resolved,
-            replacements: replaceAll ? occurrences : 1,
+            replacements,
             bytes: bytes.length,
         };
     },
 };
+/**
+ * What edit_file writes for `original`; throws the message the model sees when old_text cannot be placed.
+ * Shared with the chat's diff preview so the two never disagree.
+ */
+export function applyTextEdit(original, oldTextIn, newTextIn, replaceAll, file) {
+    // read_file shows a CRLF file without its \r, so the model sends LF text: match on LF, write back the file's own ending.
+    const crlf = original.includes('\r\n');
+    const content = crlf ? toLf(original) : original;
+    const oldText = toLf(oldTextIn);
+    const newText = toLf(newTextIn);
+    const occurrences = countOccurrences(content, oldText);
+    let updated;
+    if (occurrences === 0) {
+        const span = replaceAll ? undefined : trimmedLineMatch(content, oldText, file);
+        if (!span) {
+            throw new Error(`old_text not found in ${file}. Re-read the file (it may have changed) and try again.`);
+        }
+        updated = content.slice(0, span.start) + newText + content.slice(span.end);
+    }
+    else {
+        if (!replaceAll && occurrences > 1) {
+            throw new Error(`old_text matches ${occurrences} times in ${file}. Pass more context to make it unique, or set replace_all=true to replace all occurrences.`);
+        }
+        updated = replaceAll
+            ? content.split(oldText).join(newText)
+            // Use a replacer FUNCTION so new_text is inserted literally: a plain
+            // string 2nd arg to String.prototype.replace still honors special
+            // patterns like $&, $1, $$ even though old_text isn't a regex.
+            : content.replace(oldText, () => newText);
+    }
+    return { content: crlf ? updated.replace(/\n/g, '\r\n') : updated, replacements: replaceAll ? occurrences : 1 };
+}
+function toLf(text) {
+    return text.replace(/\r\n/g, '\n');
+}
+/**
+ * Fallback when the exact text is absent: the block of whole lines whose trimmed text equals old_text's trimmed
+ * lines (a model often gets indentation or trailing spaces wrong). Only a unique block counts.
+ */
+function trimmedLineMatch(content, oldText, file) {
+    const want = oldText.split('\n').map((l) => l.trim());
+    if (want.length > 1 && want[want.length - 1] === '')
+        want.pop();
+    if (want.every((l) => l === ''))
+        return undefined;
+    const lines = content.split('\n');
+    const starts = [];
+    for (let i = 0; i + want.length <= lines.length; i++) {
+        if (want.every((w, j) => lines[i + j].trim() === w))
+            starts.push(i);
+    }
+    if (starts.length === 0)
+        return undefined;
+    if (starts.length > 1) {
+        throw new Error(`old_text matches more than one place in ${file} once leading and trailing spaces are ignored. Pass more context to make it unique.`);
+    }
+    const offsetOf = (line) => lines.slice(0, line).reduce((n, l) => n + l.length + 1, 0);
+    const first = starts[0];
+    const last = first + want.length - 1;
+    return { start: offsetOf(first), end: offsetOf(last) + lines[last].length };
+}
 function countOccurrences(haystack, needle) {
     if (needle.length === 0)
         return 0;

package/dist/tools/fetch-url.d.ts

@@ -2,27 +2,10 @@ import { z } from 'zod';
 import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     url: z.ZodString;
-    /**
-     * Hard cap on response body size in bytes. Defaults to 200KB. The fetch
-     * is aborted as soon as the cap is exceeded, so a runaway response cannot
-     * blow up the agent's context window.
-     */
     max_bytes: z.ZodOptional<z.ZodNumber>;
-    /** Per-request timeout in ms. Default 10 seconds. Set 0 to disable. */
     timeout_ms: z.ZodOptional<z.ZodNumber>;
-    /** Follow HTTP redirects. Default true. */
     follow_redirects: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    url: string;
-    timeout_ms?: number | undefined;
-    max_bytes?: number | undefined;
-    follow_redirects?: boolean | undefined;
-}, {
-    url: string;
-    timeout_ms?: number | undefined;
-    max_bytes?: number | undefined;
-    follow_redirects?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 export interface FetchUrlResult {
     /** Final URL after redirects (may differ from the input). */
     url: string;

package/dist/tools/find-references.d.ts

@@ -2,11 +2,7 @@ import { z } from 'zod';
 import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     name: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-}, {
-    name: string;
-}>;
+}, z.core.$strip>;
 export interface ReferenceHit {
     path: string;
     line: number;

package/dist/tools/find-symbol.d.ts

@@ -3,14 +3,16 @@ import type { SymbolKind } from '../code-index/types.js';
 import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     name: z.ZodString;
-    kind: z.ZodOptional<z.ZodEnum<["function", "class", "interface", "type", "enum", "const", "method"]>>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    kind?: "function" | "class" | "interface" | "type" | "enum" | "const" | "method" | undefined;
-}, {
-    name: string;
-    kind?: "function" | "class" | "interface" | "type" | "enum" | "const" | "method" | undefined;
-}>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        function: "function";
+        class: "class";
+        interface: "interface";
+        type: "type";
+        enum: "enum";
+        const: "const";
+        method: "method";
+    }>>;
+}, z.core.$strip>;
 export interface FindSymbolMatch {
     name: string;
     kind: SymbolKind;

package/dist/tools/git-diff.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../types.js';
+/** The most diff text handed to the model; the rest is cut with a note. */
+export declare const MAX_DIFF_CHARS = 60000;
+declare const params: z.ZodObject<{
+    base: z.ZodOptional<z.ZodString>;
+    staged: z.ZodOptional<z.ZodBoolean>;
+    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** A ref git will read as a ref, never as an option: no leading dash, only the characters refs and ranges use. */
+export declare function isSafeGitRef(ref: string): boolean;
+export declare const gitDiffTool: ToolDefinition<z.infer<typeof params>, string>;
+export {};